Edit Distance Correlation Attack on the Alternating Step Generator

Edit Distance Correlation Attack on the Alternating Step Generator Jovan Dj. Golid 1 * and Renato Menicocci2 1 School of Electrical Engineering, University of Belgrade Bulevar Revolucije 73, 11001 Beograd, Yugoslavia Email: golic~galeb.etf.bg.ac.yu 2 Fondazione Ugo Bordoni Via B. Castiglione 59, 00142 Roma, Italy Emaih rmenic~fub.it Abstract. A novel edit distance between two binary input strings and one binary output string of appropriate lengths which incorporates the stop/go clocking in the alternating step generator is introduced. An efficient recursive algorithm for the edit distance computation is derived. The corresponding correlation attack on the two stop/go clocked shift registers is then proposed. By systematic computer simulations, it is shown that the minimum output segment length required for a success- ful attack is linear in the total length of the two stop/go clocked shift registers.This is verified by experimental attacks on relativelyshort shift registers. Key words. Stream ciphers, clock-controlled shift registers, alternating step generator, edit distance, cryptanalysis, correlation attacks. 1 Introduction Keystream generators for stream cipher apphcations consisting of a small number of clock-controlled shift registers combined by a linear function seem to provide an efficient means for producing sequences with long period, high linear complexity, and good statistical properties, see [7]. The stop-and-go clocking is particularly popular for high speed applications. At any time, a stop/go shift register is clocked once if the clock-control input bit is equal to 1 and is not clocked at all otherwise. The clock-control sequence can be generated by another, regularly clocked shift register, whereas the inherent autocorrelation weakness due to the repetition of bits in a stop/go shift register can be overcome by linearly combining its output with the output of an additional regularly clocked shift * This work was done while the first author was with the Information Security Research Centre, Queensland University of Technology, Brisbane, Australia. Part of this work was carried out while the first author was on leave at the Isaac Newton Institute for Mathematical Sciences, Cambridge, United Kingdom. This research was supported in part by the Science Fund of Serbia, grant #04M02, through the Mathematical Institute, Serbian Academy of Science and Arts. 500 register [1], which may be the same as the clock-control one, as is the case in the well-known stop/go cascades [7]. Typically, all the shift registers have linear feedback. However, the additional linear feedback shift register (LFSR) introduced to improve the statistics is then vulnerable to a fast correlation attack based on the repetition weakness [12]. If the clock-control LFSR is itself linearly combined with the stop/go one to produce the output, then it succumbs to a specific, conditional correlation attack [10] which exploits the same repetition weakness, but in a different, perhaps unexpected way. The alternating step generator (ASG) [81 is an interesting combination of three binary LFSRs, two of which, LFSR1 and LFSR2, are stop/go clocked in a special way by the third one, LFSR3, which is regularly clocked. Instead of LFSR3, one may also use any binary keystream generator. More precisely, if the clock-control bit is equal to 1, then LFSR1 is clocked and LFSR2 is not, and if the clock-control bit is equal to 0, then LFSR2 is clocked and LFSR1 is not. The output sequence is formed as the bitwise sum of the two stop/go clocked LFSR sequences. Although it was proposed before the appearance of [12] and [10], the ASG is not vulnerable to the attacks there introduced. It is shown in [8] that the initial state of the clock-control LFSR3 can be recovered via a divide-and- conquer attack which can be regarded as a special kind of the linear consistency attack [11], which appeared later. Namely, if and only if the guess about the initial state of LFSR3 is correct, then the first binary derivative of the output sequence gives rise to the first binary derivatives of both the regularly clocked LFSR1 and LFSR2 sequences which are then easily tested for linear complexity by the Berlekamp-Massey algorithm [9]. The objective of this paper is to investigate whether a divide-and-conquer attack on LFSR1 and LFSR2 is possible. A way of doing this is to take the edit distance [2] or edit probability [3] approaches developed for memoryless combiners (for combiners with memory, see [6]) and adapt them to deal with the stop/go clocking. The main idea is to define the edit distance between two binary input strings and one binary output string of appropriate lengths as the minimum possible number of effective substitutions (complementatious) needed in the combination string, produced from the two input strings by the stop/go clocking in the ASG manner, to obtain the output string, where the minimum is taken over all binary clock-control strings. Our first result is to prove that this unusual edit distance can be computed efficiently by a recursive algorithm whose computational complexity is quadratic in the output string length. Our second contribution is to show by systematic experiments obtained by computer simulations that the minimum output sequence length required for the success of the corresponding edit distance correlation attack is linear in the total length of LFSR1 and LFSR2. The reconstruction of the LFSR3 initial state is also discussed. In Section 2, a more detailed description of the ASG along with its basic properties is provided. The edit distance and the recursive algorithm for its efficient computation are presented in Section 3, and the experimental results on the underlying embedding probabilities are shown in Section 4. The corre- 501 sponding correlation attack is explained and experimentally verified in Section 5. Conclusions and some open problems are ~ven in Section 6. 2 Alternating Step Generator In this section, we recall the structure and basic properties of the alternating step generator (ASG), as presented in [8]. As shown in Fig. 1, the output of the ASG is obtained by bitwise addition (modulo two) of the output sequences of two binary linear feedback shift registers, LFSRI and LFSR2, whose stop/go clocking is defined by a binary clock-control generator (CCG), which is typically another, but regularly clocked LFSR, denoted as LFSR3. It is assumed that LFSR1 and LFSR2 have different irreducible feedback polynomials of respective degrees rl and r2 and respective coprime periods P1 and P2. At every step, only one LFSR is stepped and the output bit is assumed to be produced in the step-then-add manner. Let c~ denote the output bit of the CCG at step t _> 1. Then, in order to obtain the ASG output bit zt at step t, we first step LFSR1 or LFSR2 depending on whether c~ = 1 or c~ = 0, respectively, and then we add modulo two the output bits of LFSR1 and LFSR2. Observe that LFSR1 is stop/go clocked, whereas LFSR2 is go/stop clocked. In [8], some good cryptographic properties of the ASG, such as a long period (P), a high linear complexity (L), and approximately uniform relative frequency of short output patterns on a period are established, under the assumption that the clock-control sequence is a de Bruijn sequence of period 2 k. More precisely, it is proven that P = P1 P2 2 k and (rl + r2) 2 k-1 < L _< (rl + r2) 2 k, whereas for approximately uniform distribution of the output patterns of length not bigger than min(rl, r2), it is in addition required that the feedback polynomials of LFSR1 and LFSR2 be primitive as well. It is expected that similar results also hold if the CCG is a LFSR with a primitive feedback polynomial whose period is coprime to P1 P2. As mentioned in the previous section, it is also shown in [8] that there exists a (linear consistency) divide-and-conquer attack on the clock-control generator. 3 Edit Distance Let X '~+1 = xl,x2,...,xrL+l and y,+l = Yl,Y2,...,Yn+I denote two binary input strings and let Z '~ = Zl, z2,..., zn denote a binary output string. Given a binary clock-control string C n -- cl, c2,..., an, let 2'* = ~1, z2,---, ~n denote the combination string produced from X 'z+l and y,+1 by the step-then-add alternating stepping according to C" (X n+l and yn+l correspond to the regularly clocked LFSR1 and LFSR2 sequences of length n + 1, respectively). Ac- cordingly, we initially have Zl = xl Y2 if cl = 0 and ~1 -- x2 Yl if cl = 1, whereas for any 1 < s < n - 1 and 0 < l < s, if l denotes the number of ones in C s, then ~s = x~+l SY3+l-Z and we have ~s+l = xl+l SYs+2-~ if cs+l = 0 and ~s+l = xl+2 $ Ys+l-I if cs+l -- 1. 502 LFSRI Zt I : LFSR2 I Fig. 1. The alternating step generator. The edit distance between a given pair of strings (X n+l, yn+l) and a given string Z ", denoted as D(X "+1, y,+x; Z,), is then defined by D(X"+I,Yn+a;Z n) = rain dH(Z",2 ~) (1) C'~E{O,1} n where dH(Z n, 2 n) denotes the Hamming distance between Z n and 2 n. In other words, the edit distance is defined as the minimum number of effective substitutions needed to obtain Z n from 2n, where the minimum is over all 2 n binary clock-control strings C n. Apart from the substitutions in the combination string 2 n, the edit transformation of the input strings (X n+x, yn+l) into the output string Z n also contains one deletion of the first bit from one of the input strings and exactly n - 1 repetitions of bits in the input strings, regardless of the clock-control string C n.

Load more